The one field you cannot reasonably guess is library: absolute, vendor-specific, and wrong by a directory on half of all installs. So the module editor carries a vendor preset picker covering the modules a CA actually meets — SoftHSM2, Thales Luna and DPoD, Entrust nShield, Utimaco, Securosys, AWS CloudHSM, YubiHSM 2, YubiKey PIV, tpm2-pkcs11, Nitrokey NetHSM and more. Choosing one fills the library path, login mode and a key-label prefix; everything stays editable.
Know its limits. A preset fills a document; it observes nothing — nothing has dlopen()ed anything or asked a token a question; the probe is still the only thing that knows. Three vendors take a "PIN" that is not a PIN, and the preset says so where you would otherwise lose an afternoon: AWS CloudHSM wants user:password, YubiHSM 2 wants the auth-key ID glued to the password, Nitrokey NetHSM wants an account password — a bare PIN gets CKR_PIN_INCORRECT and no hint why. And several modules need something outside goca before they load at all: a config file named by an environment variable, or a running daemon. The preset names it.
Now I can start from a preset and know exactly what it did not check.